Skip to content

I built an npm malware scanner in Rust because npm audit isn't enough

9.7 relevance
Score Breakdown
technical depth
9
novelty
8
actionability
9
community
8
strategic
8
personal
10

Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.

Open-source Rust CLI scanner detects malicious npm packages before installation.

AI/ML dev.to
I built an npm malware scanner in Rust because npm audit isn't enough
Summary

aegis-scan is a Rust CLI that locally scans npm packages for malware using AST analysis (tree-sitter), install script inspection, and OSV.dev CVE checks, assigning a 0-10 risk score. It detects obfuscated eval, postinstall exploits, maintainer takeovers, AI-hallucination packages, and typosquatting, with CI integration via a GitHub Action.